CVE-2025-46713: Sandboxie Buffer Overflow Vulnerability

CVE-2025-46713 Overview

CVE-2025-46713 is a buffer overflow vulnerability in Sandboxie, a sandbox-based isolation product for 32-bit and 64-bit Windows NT operating systems. The flaw resides in the API_SET_SECURE_PARAM handler, where an arithmetic overflow deep in the memory allocation subsystem causes a smaller-than-requested allocation. Subsequent writes exceed the allocated region and corrupt adjacent memory. All versions from 0.0.1 through 1.15.11 are affected. The vendor addressed the issue in Sandboxie 1.15.12.

Critical Impact
A local, authenticated attacker can trigger memory corruption in the Sandboxie service, potentially leading to code execution with elevated privileges and full compromise of confidentiality, integrity, and availability.

Affected Products

Sandboxie-plus Sandboxie versions 0.0.1 through 1.15.11
Sandboxie Plus edition (cpe:2.3:a:sandboxie-plus:sandboxie:*:*:*:*:plus:*:*:*)
Windows NT-based systems (32-bit and 64-bit) running affected Sandboxie builds

Discovery Timeline

2025-05-22 - CVE-2025-46713 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46713

Vulnerability Analysis

The vulnerability is classified as a buffer overflow [CWE-120] triggered by an arithmetic overflow in Sandboxie's memory allocation path. When user-controlled size values reach the allocator through the API_SET_SECURE_PARAM interface, integer arithmetic wraps around and produces a size smaller than the caller expected. The allocator returns a buffer sized to the wrapped value, while the caller writes the original, larger amount of data into it. This out-of-bounds write corrupts heap or kernel memory adjacent to the undersized allocation.

Because API_SET_SECURE_PARAM is exposed by the Sandboxie driver and service, exploitation occurs against a privileged component. Successful memory corruption in this context can lead to local privilege escalation or denial of service against the sandboxing subsystem itself, undermining the isolation guarantees Sandboxie is intended to provide.

Root Cause

The root cause is missing validation of size arithmetic prior to allocation. Size computations involving user-influenced values do not check for wraparound, so a large input causes the calculated allocation size to overflow and truncate. The allocation succeeds with an incorrect size and the write path proceeds with the pre-overflow length.

Attack Vector

The attack vector is local. An authenticated user on the host issues a crafted request to the API_SET_SECURE_PARAM API exposed by Sandboxie. No user interaction is required. Because the vulnerable code runs in a privileged Sandboxie component, memory corruption there escalates impact beyond the calling user's context.

No public proof-of-concept exploit is available at this time, and CISA has not listed the issue in the Known Exploited Vulnerabilities catalog. See the Sandboxie GitHub Security Advisory GHSA-5g85-6p6v-r479 for the vendor's technical description.

Detection Methods for CVE-2025-46713

Indicators of Compromise

Unexpected crashes or restarts of the SbieSvc service or Sandboxie kernel driver on affected hosts.
Windows Error Reporting entries referencing Sandboxie binaries with access violation or heap corruption exceptions.
Local processes issuing unusually large or malformed API_SET_SECURE_PARAM requests to the Sandboxie driver.

Detection Strategies

Inventory endpoints for Sandboxie installations and flag any version prior to 1.15.12 as vulnerable.
Monitor Windows Event Logs and crash dumps for faults originating in Sandboxie modules, which may indicate exploitation attempts against the allocator.
Alert on non-administrative processes interacting with the Sandboxie device interface in ways inconsistent with the Sandboxie UI or CLI.

Monitoring Recommendations

Collect endpoint telemetry for process creation, driver load, and service crashes on hosts running Sandboxie.
Correlate Sandboxie service faults with subsequent privilege escalation indicators such as new local administrator accounts or unsigned process execution.
Retain kernel crash dumps from Sandboxie-related bugchecks for forensic analysis.

How to Mitigate CVE-2025-46713

Immediate Actions Required

Upgrade all Sandboxie Plus installations to version 1.15.12 or later on every affected endpoint.
Restrict interactive and remote logon on hosts running Sandboxie to trusted users until patching is complete.
Audit installed Sandboxie versions across the estate and prioritize remediation on multi-user and developer systems.

Patch Information

Sandboxie version 1.15.12 fixes the arithmetic overflow in API_SET_SECURE_PARAM and corrects the allocation size validation. Refer to the vendor's advisory at GHSA-5g85-6p6v-r479 for release details and download links. Apply the update through standard software distribution channels and verify the running version reports 1.15.12 or higher after deployment.

Workarounds

If immediate patching is not possible, uninstall or disable the Sandboxie service on hosts where sandboxing is not essential.
Limit local logon rights on affected systems to reduce the pool of users who can invoke the vulnerable API.
Enforce application allowlisting to prevent unauthorized binaries from interacting with the Sandboxie driver interface.

bash

# Verify installed Sandboxie version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Sandboxie*" } |
  Select-Object DisplayName, DisplayVersion, Publisher